Privacy policy for shipITfor.me

1. The controller of the personal data of users of the shipITfor.me website, hereinafter the “Website”, is: GRAVITON Łukasz Kudrycki ul. Warszawska 6, unit 32 15-063 Białystok, Poland Polish tax identification number (NIP): 9662027830 REGON: 369689470

2. You can contact the Controller:

   • by email at biuro@graviton.agency,
   • by telephone at +48 790 733 988,
   • by post at ul. Stanisława Bukowskiego 1a, unit 30, 15-066 Białystok, Poland,
   • through the electronic delivery address AE:PL-65061-78145-DEUFA-28.

3. The Controller has not appointed a Data Protection Officer. Please contact the Controller directly in all matters concerning the processing of personal data.

1. This policy explains how personal data is processed in connection with:

   • using the Website,
   • sending enquiries through the contact form,
   • correspondence concerning the Controller’s services,
   • ensuring the security and proper operation of the Website.

2. The Website does not provide online sales, payments, product shipping or a newsletter.

3. The Website does not use analytics or advertising tools, does not profile users and does not contain social media plugins that transmit data when a page is merely viewed.

1. The contact form may collect the following data:

   • first and last name,
   • email address,
   • telephone number, if provided voluntarily,
   • the content of the message and any other information provided voluntarily by the user,
   • the language version in which the form was submitted.

2. To protect the form against abuse, the Website may temporarily process:

   • the IP address supplied by the network infrastructure,
   • a shortened description of the browser or device used,
   • the browser’s preferred-language information.

3. Please do not include special categories of personal data in a message, such as data concerning health, political opinions, religious beliefs, racial or ethnic origin, genetic or biometric data, or information about a person’s sex life.

1. Data submitted through the contact form is processed for the following purposes:

   • responding to an enquiry and taking steps before entering into a contract — on the basis of Article 6(1)(b) GDPR,
   • handling enquiries that do not directly concern entering into a contract — on the basis of Article 6(1)(f) GDPR, namely the Controller’s legitimate interest in conducting correspondence and providing responses,
   • establishing, pursuing or defending legal claims — on the basis of Article 6(1)(f) GDPR,
   • complying with legal obligations if the contact results in a contract — on the basis of Article 6(1)(c) GDPR.

2. Technical data is processed to protect the Website, limit automated abuse, diagnose errors and ensure service continuity. The lawful basis is Article 6(1)(f) GDPR, namely the Controller’s legitimate interest in securing the Website and its users.

3. The Controller does not use data submitted through the form to send newsletters or transfer it to a marketing automation system.

1. Providing data is voluntary, but a first and last name, email address and message are necessary to submit the form and receive a response.

2. Providing a telephone number is optional.

3. If the data required by the form is not provided, the form cannot be submitted. This does not restrict the ability to contact the Controller by other means.

1. Forms submitted successfully are stored in the Website’s own database, which is based on Payload CMS.

2. Form data is not automatically sent by email or to an external enquiry-management service.

3. Stored enquiries can be accessed only by authenticated administrators and authorised persons who require access to handle correspondence or maintain the infrastructure.

4. The Website and its database are hosted on infrastructure located in an OVH data centre in Poland.

5. The Controller applies appropriate technical and organisational measures, including access controls, authentication, restrictions on public access to the database and infrastructure safeguards.

1. Data relating to an enquiry that does not result in a contract will be retained for no longer than 12 months from the last contact.

2. If the contact results in a contract, the data will be retained for the duration of its performance and subsequently for the period required by law or necessary to establish, pursue or defend legal claims.

3. Data used by the application-level request-rate limiting mechanism is held only in application memory for no longer than 15 minutes and is not stored with the enquiry in the Payload database.

4. Technical server and security logs, if created by the infrastructure, may be retained for no longer than 30 days, unless a particular record needs to be kept for longer to investigate an incident or defend legal claims.

5. Data may be deleted sooner if it is no longer required and continued retention is neither required by law nor justified by the need to protect the Controller’s rights.

1. Data may be disclosed only to:

   • providers of hosting or related services,
   • providers of authorised technical support and IT infrastructure maintenance,
   • legal service providers where this is necessary to protect the Controller’s rights,
   • public authorities, courts or other authorised entities where disclosure is required by law.

2. Processors acting on the Controller’s behalf may use the data only under a contract and in accordance with the Controller’s instructions.

3. The Controller does not sell personal data or disclose it to advertising companies.

1. The Controller does not plan to transfer personal data outside the European Economic Area.

2. If the way the Website operates changes in the future and such a transfer becomes necessary, it will take place only in compliance with the GDPR and after this policy has been updated accordingly.

1. The Website does not use optional cookies for analytics, advertising, profiling or user tracking.

2. The Website uses the browser’s localStorage to retain three local settings:

   • shipit-cookie-notice-v1 — records that the user has dismissed the privacy notice,
   • shipit-contrast-v1 — stores the selected high-contrast preference,
   • shipit-type-v1 — stores the selected larger-text preference.

3. These settings remain on the user’s device. They are not sent to the Controller, do not identify the user and do not enable analytics or advertising.

4. The Website does not set an expiry date for these settings. They can be removed by clearing site data or local storage in the browser settings.

5. The fonts used by the Website are served from the same domain. The browser does not connect to Google Fonts to download them.

1. Subject to the conditions set out in the GDPR, users have the right to:

   • access their personal data and receive a copy of it,
   • rectify inaccurate data or complete incomplete data,
   • request erasure of their data,
   • request restriction of processing,
   • object to processing carried out on the basis of Article 6(1)(f) GDPR,
   • data portability where data is processed by automated means on the basis of a contract or consent,
   • withdraw consent at any time if a particular processing activity were to be based on consent.

2. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

3. To exercise these rights, contact the Controller using the details set out in § 1.

4. Before acting on a request, the Controller may ask for information necessary to confirm the identity of the person making it.

5. Users have the right to lodge a complaint with the President of the Personal Data Protection Office if they believe that their data is being processed unlawfully. Information on how to lodge a complaint is available at https://uodo.gov.pl/pl/83/153.

1. Users’ data is not used for profiling.

2. The Controller does not make decisions concerning users based solely on automated processing that produce legal effects or similarly significantly affect them.

The Website may contain links to external websites. After following such a link, data is processed under the rules established by the operator of that website. The Controller is not responsible for the privacy policies or operation of external websites.

1. This policy may be updated if the operation of the Website, the technologies used, the scope of data processed or applicable law changes.

2. The current version of the policy will be published on the Website together with its effective date.

This document was prepared using the structure of Verseo’s privacy policy generator and adapted to the current operation of shipITfor.me. The generator provides a document template only. Before publication, the policy should be reviewed by a lawyer against the Controller’s actual organisation, infrastructure configuration and applicable law.